Full Report
The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Hard-coded UEFI Test Key in SIMATIC IPCs
## CVE Details
- **CVE ID:** CVE-2026-72895
- **CVSS Score:** 7.7 (High) [v3.1] | 8.4 (High) [v4.0]
- **CWE:** CWE-1394: Use of Default Cryptographic Key
## Affected Systems
- **Products:**
- SIMATIC IPC227G / IPC277G / IPC277G PRO
- SIMATIC IPC327G / IPC377G
- SIMATIC IPC BX-21A
- SIMATIC IPC RW-543A
- **Versions:**
- IPC227G/277G/327G/377G: All versions < V28.01.15
- IPC BX-21A: All versions < V31.01.13
- IPC RW-543A: All versions < V1.1.4
- **Configurations:** Systems where UEFI Secure Boot is enabled.
## Vulnerability Description
A BIOS vendor test key (often referred to as a "platform key" or "master key" from the BIOS manufacturer) was inadvertently left in the UEFI Secure Boot key database. Because the private key associated with these public test keys is often publicly known or easily accessible, an attacker can sign a malicious operating system, bootloader, or UEFI application using the test key. The system firmware will treat the malicious software as trusted, effectively bypassing the Secure Boot protection mechanism.
## Exploitation
- **Status:** No reports of exploitation in the wild or public PoCs mentioned in the advisory (Not exploited).
- **Complexity:** Low (CVSS v4.0) to High (CVSS v3.1).
- **Attack Vector:** Local (Requires physical access or administrative access to the device to execute/load the signed application).
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
*(Resulting in a full compromise of the device at the firmware level.)*
## Remediation
### Patches
Siemens recommends updating to the following versions or later:
- **IPC227G/277G/327G/377G:** V28.01.15
- **IPC BX-21A:** V31.01.13
- **IPC RW-543A:** V1.1.4
**Crucial Post-Patch Step:** After upgrading the BIOS, users **must** load the BIOS default settings. If custom Secure Boot keys were previously provisioned, they must be re-provisioned after the update.
### Workarounds
- **Manual Key Removal:** Users can manually delete the specific test keys from the UEFI database:
- For RW-543A: Delete `DO NOT TRUST - AMI Test PK`
- For others: Delete `insyde-ElkhartLake`
- **Warning:** Loading BIOS default settings *before* patching will restore the insecure test keys.
## Detection
- **Indicators of Compromise:** Presence of the strings `DO NOT TRUST - AMI Test PK` or `insyde-ElkhartLake` within the UEFI Secure Boot signature databases (PK, KEK, or db).
- **Detection methods:** Inspect the Secure Boot key database via BIOS settings or using OS-level tools (e.g., `mokutil` on Linux or PowerShell `Get-SecureBootUEFI` on Windows).
## References
- **Vendor Advisory:** [https://cert-portal.siemens.com/productcert/html/ssa-159454.html](https://cert-portal.siemens.com/productcert/html/ssa-159454.html)
- **Siemens Security Guidelines:** [https://www.siemens.com/cert/operational-guidelines-industrial-security](https://www.siemens.com/cert/operational-guidelines-industrial-security)
- **BIOS Download Portal:** [https://support.industry.siemens.com/cs/ww/en/view/109763408/](https://support.industry.siemens.com/cs/ww/en/view/109763408/)